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Report  No.  99-060  December  24, 1998 

(Project  No.  8AS-0032.10) 

Johnston  Atoll  Chemical  Agent  Disposal  System 
l^eparation  for  Year  2000 


Executive  Summary 


Introduction.  This  is  one  in  a  series  of  reports  being  issued  by  the  Inspector  General, 
DoD,  in  accordance  with  an  informal  partnership  with  the  Chief  Information  Officer, 
DoD,  to  monitor  DoD  efforts  in  addressing  the  year  2000  computing  problem.  For  a 
listing  of  audit  projects  addressing  the  issue,  see  the  year  2000  webpage  on  the  IGnet  at 
ht^://www.ignet.gov. 

Audit  Objectives.  The  overall  audit  objective  was  to  determine  whether  the  Johnston 
Atoll  Chemical  Agent  Disposal  System  was  adequately  preparing  its  information 
technology  systems  to  resolve  date-processing  issues  regarding  the  year  2000 
computing  problem.  Specifically,  the  audit  determined  whether  the  Johnston  Atoll 
Chemical  Agent  Disposal  System  complied  with  the  DoD  Year  2000  Management 
Plan. 

Audit  Results.  The  Army  Project  Manager  for  Chemical  Stockpile  Disposal  did  not 
make  timely  progress  in  assessing  the  information  technology  subsystems  of  the 
Johnston  Atoll  Chemical  Agent  Disposal  System  and  did  not  prepare  the  necessary  year 
2000  documentation,  such  as  the  assessment  plan,  the  contingency  plan,  the  risk- 
management  plan,  and  the  validation  plan  and  schedule,  as  required  by  the  DoD 
Year  2000  Management  Plan.  In  addition,  the  Army  Program  Manager  for  Chemical 
Demilitarization  at  Aberdeen  Proving  Ground,  Maryland,  incorrectly  reported  the 
Johnston  Atoll  Chemical  Agent  Disposal  System  subsystem  status  in  the  monthly  report 
to  DoD.  As  a  result,  the  Army  faces  increased  risk  that  it  may  not  be  able  to 
implement  corrections  before  the  turn  of  the  century,  resulting  in  increased  risk  of 
mission  impairment,  perhaps  even  including  the  temporary  closure  of  the  Johnston 
Atoll  Chemical  Agent  Disposal  System  at  a  weekly  cost  of  $2  million.  The  audit 
results  are  detailed  in  Part  1. 

Summary  of  Recommendations.  We  recommend  that  the  Army  Program  Manager 
for  Chemical  Demilitarization  establish  a  schedule  to  identify  and  correct  year  2000 
problems  for  systems  at  Johnston  Atoll,  require  the  project  manager  at  Johnston  Atoll 
to  prepare  an  assessment  plan,  a  contingency  plan,  a  risk  management  plan  and  a 
validation  plan  and  schedule,  and  correct  the  monthly  report  to  DoD  by  indicating  that 
Ae  Process  Data  Acquisition  Reporting  System  is  not  year  2000  compliant. 


Management  Comments.  We  provided  a  draft  of  this  report  on  November  19,  1998. 
The  Army  Program  Manager  for  Chemical  Demilitarization  did  not  comment  on  the 
draft  report;  therefore,  we  request  that  the  Program  Manager  for  Chemical 
Demilitarization  provide  management  comment  on  the  final  report  by 
January  25,  1999. 
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Audit  Background 


Because  of  the  potential  failure  of  computers  to  run  or  function  throughout  the 
Government,  the  President  issued  an  Executive  Order,  “Year  2000 
Conversion,”  February  4,  1998,  making  it  policy  that  Federal  agencies  ensure 
that  no  critical  Federal  program  experiences  disruption  because  of  the  year  2000 
(Y2K)  problem  and  that  the  head  of  each  agency  ensure  that  efforts  to  address 
the  Y2K  problem  receive  the  highest  priority  attention  in  the  agency. 

The  new  target  completion  date  for  implementing  mission-critical  systems  is 
December  31,  1998.  The  DoD  Y2K  Management  Plan  also  states  the  criteria 
for  DoD  Components  to  determine  the  appropriate  Y2K  phase  for  each  system 
noted  in  the  quarterly  report.  Each  phase  represents  a  major  Y2K  program 
activity  or  segment.  Target  completion  dates  range  from  December  1996 
through  March  1999.  Each  system  must  meet  defined  exit  criteria  before 
proceeding  into  the  next  phase. 

The  Secretary  of  Defense  issued  the  memorandum  “Year  2000  Compliance”  on 
August  7,  1998,  and  stated  that  the  Y2K  computer  problem  is  a  critical  national 
Defense  issue.  He  stated  that  Military  Departments  are  responsible  for  ensuring 
that  their  list  of  mission-critical  systems  is  accurately  reported  in  the  DoD  Y2K 
database  effective  October  1,  1998.  On  August  24,  1998,  the  Deputy  Secretary 
of  Defense  directed  that  the  Military  Departments  provide  plans  for  Y2K-related 
end-to-end  testing  of  their  respective  functional  process  by  November  1,  1998. 
Public  Law  105-271,  “Year  2000  Information  and  Readiness  Disclosure  Act,” 
October  19,  1998,  is  intended  to  encourage  the  disclosure  and  exchange  of 
information  about  computer  processing  problems,  solutions,  test  practices  and 
test  results,  and  related  matters  in  connection  with  the  transition  to  the  year 
2000. 

Johnston  Atoll.  The  Army  Program  Manager  for  Chemical  Demilitarization  at 
Aberdeen  Proving  Grounds,  Maryland,  is  responsible  for  the  safe  destruction  of 
all  chemical  warfare  agents,  including  nerve  gas  and  blister  agents.  The 
program  manager  oversees  and  manages  nine  chemical  stockpile  sites.  Of  the 
nine  sites,  only  two  have  active  chemical  weapons  disposal  facilities.  One  of 
these  is  at  Johnston  Atoll,  which  is  an  island  located  southwest  of  Hawaii.  The 
mission  of  the  Army  project  manager  at  Johnston  Atoll  is  to  destroy  stockpile 
chemical  weapons.  The  destruction  process  includes  preparation,  treatment,  air 
pollution  abatement,  by-product  disposal,  system  performance,  public 
confidence,  and  lessons  learned.  The  disposal  occurs  in  the  Johnston  Atoll 
Chemical  Agent  Disposal  System  (JACADS).  The  Army  began  to  destroy  its 
stocl^ile  of  chemical  munitions  in  June  1990  and  should  complete  it  shortly 
after  the  year  2000.  The  Army  operates  the  site  under  a  permit  originally  issued 
in  August  1985  and  renewed  in  July  1998  by  the  Environmental  Protection 
Agency.  The  permit  allows  the  Army  to  operate  a  hazardous  waste  storage  ^d 
incineration  facility,  requires  the  Army  to  take  samples  of  the  waste  and  retain 
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records  of  samples  and  all  monitoring  information  for  a  period  of  3  years.  The 
data  must  be  immediately  available  for  inspection  by  Environmental  Protection 
Agency  officials. 


Audit  Objectives 


The  primary  audit  objective  was  to  determine  whether  the  project  manager  for 
JACADS  was  adequately  preparing  its  information  technology  systems  to 
resolve  date-processing  issues  for  the  year  2000  computing  problem. 
Specifically,  the  audit  determined  whether  the  project  manager  for  JACADS 
complied  with  the  DoD  Year  2000  Management  Plan.  Appendix  A  describes 
the  audit  scope  and  methodology,  the  results  of  the  management  control 
program  review,  and  a  summary  of  prior  coverage. 
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Johnston  Atoll  Chemical  Agent  Disposal 
System  Preparation  for  Year  2000 

The  Arniy  project  manager  at  Johnston  Atoll  did  not  make  timely 
progress  in  assessing  the  information  technology  subsystems  of 
JACADS.  Also,  he  did  not  prepare  the  necessary  Y2K  documentation 
required  by  Ae  DoD  Y2K  Management  Plan,  such  as  the  assessment 
plan,  the  contingency  plan,  the  risk-management  plan,  and  the  validation 
plan  and  schedule.  In  addition,  the  Army  program  manager  incorrectly 
r^orted  the  JACADS  subsystem  status.  This  condition  occurred 
because  of  a  lack  of  oversi^t  by  the  program  manager  in  reporting  the 
Y2K  status  for  JACADS  and  emphasis  in  preparing  Y2K  documentation. 
As  a  result,  the  Army  may  not  be  able  to  implement  corrections  before 
the  turn  of  the  century,  thus  increasing  risk  of  mission  impairment, 
perhaps  even  including  die  temporary  closure  of  the  Johnston  Atoll 
Chemical  Agent  Disposal  System  at  a  weekly  cost  of  $2  million. 


Assessment  and  Renovation  Phase  Requirements 


Assessment  Phase.  The  assessment  phase  is  used  to  gather  and  analyze 
information.  DoD  Components  must  develop  a  Y2K  assessment  plan  that 
includes  the  size  and  scope  of  the  problem,  necessary  infrastructures,  software 
inventories,  a  Y2K  cost  estimate  to  repair  an  existing  system,  and  identifies 
system  interfaces.  Also,  DoD  Components  must  prepare  a  contingency  plan 
that  considers  the  consequences  of  noncompliance  and  a  risk-management  plan 
that  identifies  how  tiie  system  may  fail,  the  impact  on  the  mission,  and  how  the 
failure  will  affect  other  functions  and  missions.  A  contingency  plan  should  be 
completed  for  all  mission-critical  systems  that  have  not  completed  the 
implementation  phase  by  December  1998. 

The  DoD  Management  Plan  required  the  completion  of  the  assessment  phase  for 
mission-critical  systems  by  June  30,  1997.  In  addition,  the  DoD  Components 
must  prepare  an  assessment  plan,  a  contingency  plan,  and  a  risk  management 
plan  as  part  of  the  exit  criteria  to  proceed  to  the  next  Y2K  phase.  T^e  plans  are 
management  tools  to  assist  managers  in  making  their  systems  compliant. 

Renovation  Phase.  The  renovation  phase  is  to  make  the  system  Y2K  compliant 
by  fixing,  replacing,  or  retiring  the  system.  This  phase  required  each  DoD 
Component  to  develop  and  document  a  validation  plan  and  schedule.  The 
validation  plan  should  indicate  when  all  systems  should  be  validated  and  should 
address  fteir  testing  environments.  Mission-critical  systems  should  have 
completed  this  phase  by  June  30,  1998. 
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Johnston  Atoll  Chemical  Agent  Disposal  Systm  Preparation  for  Year  2000 


Y2K  Monthly  Report 


A  June  19,  1998,  memorandum  from  the  Assistant  Secretary  of  Defense 
(Command,  Control,  Communication,  and  Intelligence)  requires  DoD 
Components  to  submit  monthly  reports  to  DoD  and  the  Office  of  Management 
and  Budget  to  help  tfiem  to  oversee  and  monitor  the  DoD  compliance  effort,  to 
identify  and  prioritize  risks,  and  to  solve  Y2K  problems  quickly.  If  erroneous 
information  goes  unrecognized,  computers  and  weapon  systems  may  fail,  and 
Ae  problem  will  perpetuate  through  interfaces  and  other  automated  information 
systems. 


Timely  Assessment 


The  Army  project  manager  at  Johnston  Atoll  did  not  begiii  to  assess  the 
JACADS  until  the  summer  of  1998  because  of  other  priorities  such  as  the 
renewal  of  die  Environmental  Protection  Agency  permit.  The  project  manager 
assessed  the  four  subsystems  of  JACADS  that  include  the  Process  Data 
Acquisition  Reporting  System,  Automatic  Continuous  Air  Monitoring  System, 
JACADS  Control  Code,  and  the  Supply  and  Purchasing  Tracking  System.  The 
Process  Data  Acquisition  Reporting  System  is  not  compliant,  the  Automatic 
Continuous  Air  Monitoring  System’s  Y2K  status  is  not  known,  and  the  other 
two  subsystems  are  compliant. 

Process  Data  Acquisition  Reporting  System.  The  Process  Data  Acquisition 
R^orting  mission-critical  system  communicates  with  the  plant  control  system. 

It  consists  of  software,  hardware,  and  an  operating  system  that  record  alarm, 
event,  and  analog  data  when  they  occur.  Alarm  data  identify  problems 
associated  with  Ae  plant  alarm  system.  Event  data  monitor  and  record 
information  related  to  mechanical  function  of  the  plant  such  as  switches. 

Analog  ^ta  record  information  such  as  furnace  pressure  or  temperature 
every  3  seconds.  All  data  are  vital  to  the  safe  o^ration  of  the  plant,  which 
must  function  in  compliance  with  the  Environmental  Protection  Agency  permit. 

The  project  manager  identified  that  the  software  and  operating  systems  for  the 
Process  Data  Acquisition  Reporting  System  are  not  Y2K  compliant  because  the 
software  uses  2-digit  years,  and  because  the  manufacturer  no  longer  supports  the 
operating  system  and  will  not  certify  that  it  is  Y2K  compliant.  The  project 
manager  plans  to  lease  a  redundant  compliant  system  to  use  as  a  test  bed  for 
maldng  Y2K  corrections.  Changes  cannot  be  made  to  the  on-line  system  while 
Ae  JACADS  is  operating  because  of  Environmental  Protection  Agency 
reporting  requirements.  The  project  manager  also  plans  to  upgrade  the  software 
on  the  redundant  system  and  make  other  changes  to  ensure  that  the  redundant 
system  rqiorts  accurate  information.  Once  the  leased  system  is  Y2K  compliant, 
the  changes  will  be  made  to  the  on-line  system  during  the  next  shutdown  in 
1999.  The  request  for  quotation  for  the  leased  system  was  in  draft  in  October 
1998. 
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The  Army  Program  Manager  for  Chemical  Demilitarization,  Aberdeen  Proving 
Ground,  Maryland,  who  oversees  the  plant’s  operation  at  Johnston  Atoll,  stated 
that  Ae  project  manager’s  proposed  plan  is  one  of  several  options  being 
considered.  A  final  decision  for  making  the  system  Y2K  compliant  has  not  yet 
been  made. 

Automatic  Continuous  Air  Monitoring  System.  The  Automatic  Continuous 
Air  Monitoring  System  monitors  the  air  in  the  JACADS  facility  for  foreign 
agents.  It  is  a  mission-critical  system  that  is  operated  by  a  microprocessor, 
which  controls  the  sequence  of  steps  to  acquire  an  air  sample,  analyze  it, 
convert  the  results  to  data,  and  transmit  the  data  to  the  plant  control  system. 

The  system  samples  the  air  every  3  to  5  minutes,  and  if  a  sample  does  not  fall 
within  set  parameters,  an  alarm  alerts  officials  of  potential  atmospheric 
contamination.  Time  is  used  to  record  the  date  of  the  event  but  does  not  affect 
the  operation  of  the  alarm  system. 

Army  officials  at  Johnston  Atoll  have  about  90  Automatic  Continuous  Air 
Monitoring  systems  within  the  JACADS  facility.  The  Army  project  manager  at 
Johnston  Atoll  received  conflicting  information  concerning  the  system’s  Y2K 
compliance  status.  The  Army  conducted  a  rollover  test  on  the  system  and  found 
that  it  operated  without  errors.  The  rollover  test  set  the  clocks  to  just  before  the 
year  2000  and  allowed  them  to  roll  over.  Raytheon,  an  Army  advisor,  stated 
that  the  system  is  not  Y2K  compliant  based  on  their  rollover  test.  They  are 
unsure  whether  the  monitoring  devices  are  Y2K  compliant,  whether  they  will 
provide  accurate  information  after  the  year  2000,  and  whether  they  will 
compromise  other  interface  systems.  The  Project  Manager  plans  to  determine 
the  Y2K  status  by  December  1998,  and  make  improvements,  if  necessary. 

\  The  project  manager’s  late  start  in  assessing  the  subsystems  caused  him  to  miss 
the  June  30,  1997,  deadline  for  completing  the  assessment  phase  and  the 
June  30,  1998,  deadline  for  completing  the  renovation  phase  for  mission-critical 
systems.  In  addition,  the  Y2K  planning  and  execution  stages  are  only  in  the 
initial  phases.  The  Army  program  manager,  Aberdeen  Proving  Ground, 
Maryland,  still  has  not  determined  how  to  correct  the  problem  with  the  Process 
Data  Acquisition  Reporting  System  or  whether  the  Automatic  Continuous  Air 
Monitoring  System  is  Y2K  compliant  and  will  impact  other  interface  systems. 
The  program  manager  should  prepare  a  schedule  for  identifying  and  correcting 
Y2K  problems  for  die  affected  subsystems  at  JACADS. 


Documentation  and  Reporting 


Y2K  Planning  Tools.  The  Army  did  not  prepare  an  assessment  plan,  a 
contingency  plan,  and  a  risk-management  plan  for  any  of  the  JACADS 
subsystems.  The  Army  program  manager  at  Aberdeen  Proving  Grounds  and  the 
project  manager  at  JACADS  stated  that  they  were  preparing  these  plans  but  had 
not  yet  completed  them.  In  October  1998,  the  Army  program  manager  had  a 
brief  outline  of  the  contingency  plan.  The  DoD  Management  Plan  required 
DoD  Components  to  complete  the  plans  for  all  mission-critical  systems  to 
complete  the  assessment  phase  by  June  30,  1997. 
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The  Army  also  did  not  develop  and  document  a  validation  plan  and  schedule. 
The  DoD  Management  Plan  requires  DoD  Components  to  prepare  the  validation 
plan  and  schedule  for  all  mission-critical  systems  to  complete  the  renovation 
phase  by  June  30,  1998. 

All  the  plans  are  critical.  Much  additional  work  is  needed  to  plan  and  execute 
corrections  in  time  to  make  JACADS  Y2K  compliant.  DoD  Components  must 
prepare  the  plans  and  a  schedule  making  the  affected  subsystems  Y2K 
compliant. 

Y2K  Report.  The  Army  Program  Manager  for  Chemical  Demilita,rization  did 
not  accurately  report  die  status  of  the  JACADS  in  the  DoD  monthly  report.  In 
the  July  1998  report  to  DoD,  the  program  manager  reported  five  subsystems 
while  the  project  manager  at  Johnston  Atoll  reported  to  us  that  there  were  only 
four,  because  the  maintenance  tracking  system  and  the  supply  purchase  tracking 
system  were  combined  in  early  1998.  The  September  1998  report  corrected  this 
oversight.  However,  both  the  July  and  September  1998  monthly  reports  showed 
the  Process  Data  Acquisition  Reporting  System  as  Y2K  compliant. 

To  comply  with  the  Secretary  of  Defense  memorandum  of  August  7,  1998,  the 
status  of  mission-critical  systems  reported  to  DoD  must  be  accurate  and 
consistent.  Without  accurate  reporting,  DoD  cannot  oversee  and  monitor 
Components’  compliance  effort  to  identify  and  prioritize  risks  and  to  solve  Y2K 
problems  quickly.  The  program  manager  must  revise  the  monthly  report  to 
reflect  the  current  Y2K  status  for  the  Process  Data  Acquisition  Reporting 
System. 


Oversig^it 


The  Army  Program  Manager  for  Chemical  Demilitarization  at  Aberdeen 
Proving  Grounds  did  not  provide  oversight  to  the  JACADS.  The  program 
manager  did  not  visit  JACADS  and  did  not  verify  the  progress  reported  to  DoD 
in  making  the  Johnston  system  Y2K  compliant.  For  example,  the  Army  ^ 
program  manager  concluded  that  the  Process  Data  Acquisition  Reporting  System 
was  Y2K  compliant,  yet  Army  officials  indicated  that  it  needs  major  repairs  and 
the  leasing  of  a  redundant  system  to  make  it  compliant.  In  addition,  the 
program  manager  did  not  require  the  project  manager  to  prepare  an  assessment 
plan,  a  contingency  plan,  a  risk-management  plan,  and  a  validation  plan  and 
schedule  for  the  JACADS  subsystems.  In  August  1997,  program  management 
officials  believed  the  system  to  be  Y2K  compliant,  based  on  preliminary  test 
results  of  the  JACADS.  Later  information  showed  that  the  level  of  testing  was 
insufficient.  However,  program  management  officials  did  not  take  appropriate 
oversight  action  to  ensure  that  reporting  was  accurate  and  that  documentation 
was  available  and  prepared  by  the  JACADS  project  manager. 

The  lack  of  site  visits  to  address  the  problems  at  JACADS  contributed  to  the 
misunderstanding  and  untimely  implementation  of  corrections.  If  program 
management  officials  provided  the  proper  oversight  to  the  project  manager  at 
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JACADS,  the  project  manager  may  have  prepared  the  necessary  tools  for 
managing  the  Y2K  problem,  reported  the  correct  system  status,  and  begun  the 
Y2K  assessment  earlier. 


Current  Management  Action 

The  Program  Manager  for  Chemical  Demilitarization  at  Aberdeen  Proving 
Grounds  held  a  meeting  in  October  1998  for  the  nine  Chemical  Stockpile  project 
managers  to  discuss  and  complete  a  Y2K  program  implementation  plan.  The 
objectives  of  the  meeting  were  to  complete  an  overall  program  strategy  and  an 
assessment  strategy,  and  develop  guidelines  for  site  testing  and  contingency 
planning.  The  meeting  results  should  helj)  in  the  assessment  of  Y2K  for 
JACADS  and  other  chemical  demilitarization  sites  and  with  the  preparation  of 
necessary  planning  documentation.  In  addition,  the  program  manager  was 
planning  to  procure  the  Year  2000  Repository  from  Raytheon  Engineers  and 
Constructors  for  all  of  the  sites.  This  is  a  multi-industry  Y2K  database  that 
provides  a  methodology  for  collecting  and  classifying  inventory,  a  repository  of 
potential  plant  floor  issues  and  solutions,  assessment  impact,  and  remediation 
reports.  The  database  will  help  in  the  assessment  of  systems  to  determine  their 
Y2K  status,  but  it  is  not  an  overall  solution. 


Recommendations  for  Corrective  Action 

We  recommend  that  the  Program  Manager  for  Chemical  Demilitarization: 

1.  Establish  a  schedule  to  identify  and  correct  year  2000  problems  on 
systems  at  Johnston  Atoll. 

2.  Require  the  Project  Manager  for  Chemical  Stockpile  Disposal  at 
Johnston  Atoll  to  prepare  an  assessment  plan,  a  contingency  plan,  a  risk- 
management  plan,  and  a  validation  plan  and  schedule. 

3.  Correct  the  DoD  monthly  report  by  indicating  that  the  Process  Data 
Acquisition  Reporting  System  is  not  year  20()0  compliant. 


Management  Comments  Required 

We  provided  a  draft  of  this  report  on  November  19, 1998.  The  Army  Program 
Manager  for  Chemical  Demilitarization  did  not  comment  on  the  draft  report;  therefore, 
we  request  Aat  management  comment  on  the  final  report. 
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Part  II  -  Additional  Information 


Appendix  A.  Audit  Process 


TTiis  in  one  in  a  series  of  reports  being  issued  by  the  Inspector  General,  DoD,  in 
accor(^ce  with  an  informal  partnership  with  the  Chief  Information  Officer, 
DoD,  to  monitor  DoD  efforts  to  address  the  Y2K  computing  challenge.  For  a 
listing  of  audit  projects  addressing  this  issue,  see  the  Y2K  webpage  on  IGnet  at 
<  littp://www.  ignet.gov  > . 


Scope 

Work  Performed.  We  reviewed  and  evaluated  the  progress  made  on  the 
Johnston  Atoll  Chemical  Agent  Disposal  System  in  resolving  die  Y2K 
computing  issue.  We  evaluated  Y2K  efforts  made  and  compared  them  with  the 
DoD  Management  Plan;  conducted  discussions  with  technical,  business,  and 
contracting  officials;  and  evaluated  Y2K  documentation  where  available. 

DoD-wide  Corporate  Level  Government  Performance  and  Results  Act 
Goals.  In  response  to  the  Government  Performance  and  Results  Act,  the  DoD 
has  established  6  DoD-wide  corporate  level  performance  objectives  and  14  goals 
for  meeting  those  objectives.  This  report  pertains  to  achievement  of  the 
following  objective  and  goal: 

•  Objective:  Prepare  now  for  the  uncertain  future. 

•  Goal:  Pursue  a  focused  modernization  effort  that  maintains  U.S. 
qualitative  superiority  in  key  war-fighting  capabilities.  (DoD-3) 

DoD  Functional  Area  Reform  Goals.  Most  major  DoD  functional  areas  hmre 
also  established  performance  improvement  reform  objectives  and  goals.  This 
report  pertains  to  achievement  of  the  following  functional  area  objective  and 
goal: 

Information  Technology  Management  Functional  Area. 

•  Objective:  Provide  services  that  satisfy  customer  information  needs. 

•  Goal:  Upgrade  technology  base.  (ITM-2-3) 

General  Accounting  Office  High-Risk  Area.  In  its  identification  of  risk 
areas,  the  General  Accounting  Office  has  specifically  designated  risk  in 
resolution  of  the  Y2K  problem  as  high.  This  report  provides  coverage  of  that 
problem  and  of  the  overall  Information  Management  and  Technology  high-risk 
area. 
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Methodology 

Audit  Type,  Dates,  and  Standards.  We  performed  this  economy  and 
efficiency  audit  from  August  through  November  1998,  in  accordance  with 
auditing  standards  issued  by  the  Comptroller  General  of  the  United  States,  as 
implemented  by  the  Inspector  General,  DoD.  We  did  not  rely  on  computer- 
processed  data  or  statistical  sampling  procedures  to  develop  conclusions  on  this 
audit. 

Contacts  During  the  Autht.  We  visited  or  contacted  individuals  and 
organizations  within  DoD.  Further  details  are  avjulable  on  request. 

Management  Control  Program.  We  did  not  review  the  management  control 
program  related  to  the  overall  audit  objective  because  DoD  recognized  the  Y2K 
issue  as  a  material  management  control  weakness  area  in  the  FY  1997  Annual 
Statement  of  Assurance. 


Summary  of  Prior  Coverage 


The  General  Accounting  Office  and  the  Inspector  General,  DoD,  have 
conducted  multiple  reviews  relating  to  Y2K  issues.  General  Accounting  Office 
reports  can  be  accessed  over  the  Internet  at  http://www.gao.gov.  Inspector 
General,  DoD,  reports  can  be  accessed  over  the  Internet  at 
http://www.dodig.osd.mil. 
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Appendix  B.  Report  Distribution 


Office  of  the  Secretary  of  Defense 

Under  Secretary  of  Defense  for  Acquisition  and  Technology 
Director,  Defense  Procurement 

Director,  Defense  Logistics  Studies  Information  Exchange 
Under  Secreti^  of  Defense  (Comptroller) 

Deputy  Chief  Financial  Officer 
Deputy  Comptroller  (Program/Budget) 

Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and  Intelligence) 
Deputy  Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and 
Intelligence,  Surveillance,  Reconnaissance,  and  Space  Systems) 

Deputy  Chief  Information  Officer  and  Deputy  Assistant  Secretary  of  Defense  (Chief 
Information  Officer  Policy  and  Implementation) 

Principal  Deputy  -  Y2K 
Assistant  Secretary  of  Defense  (Public  Affairs) 

Director,  Joint  Staff 


Department  of  the  Army 

Assistant  Secretary  of  the  Army  (Research,  Development,  and  Acquisition) 
Chief  Information  Officer  Army 
Inspector  General,  Department  of  the  Army 
Auditor  General,  Department  of  the  Army 


Department  of  the  Navy 

Assistant  Secretary  of  the  Navy  (Financial  Management  and  Comptroller) 
Chief  Information  Officer,  Navy 
Auditor  General,  Department  of  the  Navy 


Department  of  the  Air  Force 

Assistant  Secretary  of  the  Air  Force  (Financial  Management  and  Comptroller) 
Chief  Information  Officer,  Air  Force 
Inspector  General,  Department  of  the  Air  Force 
Auditor  General,  Air  Force  Audit  Agency 
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Appendix  B.  Report  Distribution 


Other  Defense  Organizations 


Director,  Defense  Information  Systems  Agency 

Inspector  General,  Defense  Information  Systems  Agency 
Director,  National  Security  Agency 

Inq)ector  General,  National  Security  Agency 
Inspector  General,  Defense  Intelligence  Agency 
Inspector  General,  National  Imagery  and  Mapping  Agency 
Inspector  General,  National  Reconnmssance  Office 


Non-Defense  Federal  Organizations  and  Individuals 

Office  of  Management  and  Budget 

Office  of  Information  and  Regulatory  Affairs 
Technical  Information  Center,  National  Security  and  International  Affairs  Division, 
General  Accounting  Office 

Director,  Defense  Information  and  Financial  Management  Systems,  Accounting  and 
Information  Management  Division,  General  Accounting  Office 

Chairman  and  ranking  minority  member  of  each  of  the  following  congressional 
committees  and  subcommittees: 

Senate  Committee  on  Appropriations 

Senate  Subcommittee  on  Defense,  Committee  on  Appropriations 

Senate  Committee  on  Armed  Services 

Senate  Committee  on  Governmental  Affairs 

Senate  Special  Committee  on  the  Year  2000  Technology  Problem 

House  Committee  on  Appropriations 

House  Subcommittee  on  National  Security,  Committ^  on  Appropriations 
House  Committee  on  Government  Reform  and  Oversight 
House  Subcommittee  on  Government  Management,  Information,  and  Technology, 
Committee  on  Government  Reform  and  Oversight 
House  Subcommittee  on  National  Security,  International  Affairs,  and  Criminal 
Justice,  Committee  on  Government  Reform  and  Oversight 
House  Committee  on  National  Security 
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Audit  Team  Members 

The  Ac^isition  Management  directorate,  Office  of  the  Assistant  Inspector  General 
for  Auditing,  DoD,  produced  this  report. 

Thomas  F.  Gimble 
Patricia  A.  Brannin 
Raymond  A.  Spencer 
Thomas  S.  Bartoszek 
Eric  D.  Broderius 
Karen  J.  Layton 
Jenshel  D.  Marshall 


